Ssh MCP

by tufantunc• 852•• Scanned•Claim this listing•Request removal
Other

MCP server exposing SSH control for Linux servers via Model Context Protocol.

Ssh MCP is an open-source mcp server by tufantunc, written mainly in TypeScript, with 852 GitHub stars and the MIT license. Its code was last updated Nov 1, 2026. The latest npm release is ssh-mcp 2.26.0, published Nov 12, 2026, with 19,226 downloads last week.

Scan summary: scanned Nov 5, 2026 at commit 4a84fc7. Seen able to run shell commands, read environment and secrets. Scan policy

aboutREADMEsecurityreviews

How to install Ssh MCP

Built from the start command in the project's README: npx ssh-mcp --host=1.2.3.4 --user=root --password=hunter2. Check the README for required keys or settings.

Claude Code · Terminal
claude mcp add ssh-mcp -- npx ssh-mcp --host=1.2.3.4 --user=root --password=hunter2
Claude Desktop · claude_desktop_config.json
{
  "mcpServers": {
    "ssh-mcp": {
      "command": "npx",
      "args": [
        "ssh-mcp",
        "--host=1.2.3.4",
        "--user=root",
        "--password=hunter2"
      ]
    }
  }
}
Cursor · .cursor/mcp.json
{
  "mcpServers": {
    "ssh-mcp": {
      "command": "npx",
      "args": [
        "ssh-mcp",
        "--host=1.2.3.4",
        "--user=root",
        "--password=hunter2"
      ]
    }
  }
}
VS Code · Terminal
code --add-mcp '{"name":"ssh-mcp","command":"npx","args":["ssh-mcp","--host=1.2.3.4","--user=root","--password=hunter2"]}'

What Ssh MCP can touch

  • Run shell commandsListed as a tool: run-command
  • Run dynamic codeNot seen in this scan
  • Read or write filesNot seen in this scan
  • Read environment and secretsFound in the code by our scan
  • Control a web browserNot seen in this scan
  • Connect to databasesNot seen in this scan
  • Read or send messagesNot seen in this scan
  • Touch money or tradingNot seen in this scan
  • Connect to the internetNo connections seen while running

"Not seen" means our checks did not find it, and the tool may still do it. Covers commit 4a84fc7, Nov 5, 2026. See the scan policy.

Before you install Ssh MCP

AgenticMart scanned Ssh MCP on Nov 5, 2026 with automated checks for hidden code, known-malicious packages, leaked secrets and vulnerable dependencies. The result covers one commit under our scan policy, so review what access you give it and check any advisories shown here.

What it can access

  • An MCP server is a program your AI app starts and talks to. A local one runs with your user's permissions: it can see the files, environment variables and network your account can.
  • Based on its description and topics, it likely needs to run shell commands.

Before you install

  1. Keep tool-call approval on, and run it in a container if you can.
  2. Pin the version you reviewed instead of always installing the latest release.
  3. Read the tool list or scripts before the first run, and keep approval prompts on for actions that write, send or delete.
  • Maintained by tufantunc on GitHub, 852 stars and 133 forks. Popularity is not proof of safety.
  • Last code change: Nov 1, 2026.
  • Open-source license: MIT.
Read the scan reportWhat our scan checks

Tools Ssh MCP exposes (15)

Listed by the server itself during our scan of commit 4a84fc7.

  • list-connections

    List all configured SSH profiles and their connection status. Use this to discover available hosts before running commands.

  • list-sessions

    List active sessions for a given SSH profile.

  • open-session

    Open a named session on a remote host. Use type="interactive" for stateful shell (CWD/env persists between commands) or type="background" for long-running processes.

  • close-session

    Close a named session. A background session's command is signalled on the host (INT, then TERM, then KILL) before its channel is dropped; an interactive session's shell is ended. The response says so if the command could not be signalled or had not stopped in time.

  • read-session-output

    Read recent output from a background session (e.g., tail -f logs).

  • read-command

    Execute a READ-ONLY command from an allowlist (ls, cat, grep, find, stat, df, etc.). This tool does NOT modify the system. Prefer this tool for all read operations. Single-line only: a command containing a line break is refused, so upload a multi-line script with sftp-upload and run it by path.

  • run-command

    Execute an arbitrary shell command on the remote server. May modify the system. Commands classified destructive or privileged go through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal. Single-line only: a command containing a line

  • privileged-command

    Execute a command with sudo elevation. Goes through the approval gate; approvalPolicy on the profile decides whether that is a prompt, an automatic allow, or a refusal. The sudo password is piped via stdin for the prompt only (never visible in process list); the command itself runs with stdin at /de

  • signal-process

    Send a signal (INT, TERM, KILL) to a remote process by PID.

  • sftp-upload

    Upload a file to the remote server via SFTP (secure file transfer, not shell-based). Replaces an existing file at that path unconditionally — there is no overwrite flag and no way to require a new destination.

  • sftp-download

    Download a file from the remote server via SFTP.

  • sftp-list

    List a remote directory over SFTP, with a bounded number of entries and a bounded response size. Read-only.

  • sftp-upload-file

    Upload a local file to the remote host over SFTP, streaming it without passing the contents through model context. The local file must be inside the transferRoot directory the operator configured; without that setting this tool refuses. Use this for binary or large files; use sftp-upload for short t

  • sftp-download-file

    Download a remote file to local disk over SFTP, streaming it without passing the contents through model context. The destination must be inside the transferRoot directory the operator configured; without that setting this tool refuses. Use this for binary or large files; use sftp-download when you n

  • reload-config

    Report or reload the server's config file. action="status" (the default) shows the config path, when it was loaded, the sha256 of its bytes and the result of the last reload; never the contents. action="reload" re-reads the file, validates it exactly as startup does, and applies it only if every che

Ssh MCP is an open-source mcp server by tufantunc, written mainly in TypeScript. MCP server exposing SSH control for Linux servers via Model Context Protocol.

At a glance

Stars
852
Forks
133
Language
TypeScript
License
MIT
Created
Apr 2025
Last update
Nov 1, 2026
Type
MCP Server
Price
Free

Questions about Ssh MCP

What is Ssh MCP?

MCP server exposing SSH control for Linux servers via Model Context Protocol.

Who maintains Ssh MCP?

Ssh MCP is maintained by tufantunc on GitHub (tufantunc/ssh-mcp). AgenticMart lists it from public repository data.

Is Ssh MCP safe to use?

AgenticMart scanned Ssh MCP on Nov 5, 2026 with automated checks for hidden code, known-malicious packages, leaked secrets and vulnerable dependencies. The result covers one commit under our scan policy, so review what access you give it and check any advisories shown here.

What license does Ssh MCP use?

It is published under the MIT license.

Ssh MCP alternatives

View more →

Similar mcp servers in Other, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.

NameStarsLicenceLast updatedScan
Ssh MCP (this page)
tufantunc
852MITNov 1, 2026Scanned, no flagged issues
Github MCP Server
github
34kMITOct 30, 2026Scanned, no flagged issues
Fastapi MCP
tadata-org
12kMITNov 24, 2025Scanned, no flagged issues
GhidraMCP
LaurieWired
12kApache-2.0Oct 10, 2026Scanned, no flagged issues
MCP Go
mark3labs
9.2kMITOct 30, 2026Scanned, no flagged issues
Git MCP
idosal
8.5kApache-2.0May 8, 2026Scanned, no flagged issues